Archive
February 2017
Vulnerabilities first published in this month (UTC), newest first.
1,041 results · Feed
-
Unscored —
The aio_mount function in fs/aio.c in the Linux kernel before 4.7.7 does not properly restrict execute access, which ma…
-
Unscored —
PEAR HTML_AJAX 0.3.0 through 0.5.7 has a PHP Object Injection Vulnerability in the PHP Serializer. It allows remote cod…
-
Unscored —
The TIFFGetField function in coders/tiff.c in GraphicsMagick 1.3.24 allows remote attackers to cause a denial of servic…
-
Unscored —
Heap-based buffer overflow in the EscapeParenthesis function in GraphicsMagick before 1.3.25 allows remote attackers to…
-
Unscored —
Integer underflow in the parse8BIM function in coders/meta.c in GraphicsMagick 1.3.25 and earlier allows remote attacke…
-
Unscored —
Buffer overflow in the MVG and SVG rendering code in GraphicsMagick 1.3.24 allows remote attackers to have unspecified …
-
Unscored —
The Utah RLE reader in GraphicsMagick before 1.3.25 allows remote attackers to cause a denial of service (CPU consumpti…
-
Unscored —
OpenAFS 1.6.19 and earlier allows remote attackers to obtain sensitive directory information via vectors involving the …
-
Unscored —
Integer overflow in the writeBufferToSeparateStrips function in tiffcrop.c in LibTIFF before 4.0.7 allows remote attack…
-
Unscored —
Buffer overflow in the readgifimage function in gif2tiff.c in the gif2tiff tool in LibTIFF 4.0.6 allows remote attacker…
-
Unscored —
ZoneMinder v1.30 and v1.29, an open-source CCTV server web application, is vulnerable to CSRF (Cross Site Request Forge…
-
Unscored —
Multiple reflected XSS vulnerabilities exist within form and link input parameters of ZoneMinder v1.30 and v1.29, an op…
-
Unscored —
A file disclosure and inclusion vulnerability exists in web/views/file.php in ZoneMinder 1.x through v1.30.0 because of…
-
Critical 9.8
The installation wizard in DotNetNuke (DNN) allows privilege escalation
The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx.
-
Unscored —
An issue was discovered in Exponent CMS 2.4.1. This is a blind SQL injection that can be exploited by un-authenticated …
-
Unscored —
XSS was discovered in dotCMS 3.7.0, with an unauthenticated attack against the /news-events/events date parameter.
-
Unscored —
XSS was discovered in dotCMS 3.7.0, with an authenticated attack against the /myAccount addressID parameter.
-
Unscored —
XSS was discovered in dotCMS 3.7.0, with an unauthenticated attack against the /about-us/locations/index direction para…
-
Unscored —
The smbhash function in fs/cifs/smbencrypt.c in the Linux kernel 4.9.x before 4.9.1 interacts incorrectly with the CONF…
-
Unscored —
The crypto scatterlist API in the Linux kernel 4.9.x before 4.9.6 interacts incorrectly with the CONFIG_VMAP_STACK opti…
-
Unscored —CVE-2016-10150 EPSS 10%
Use-after-free vulnerability in the kvm_ioctl_create_device function in virt/kvm/kvm_main.c in the Linux kernel before …
-
Unscored —
The ext4_fill_super function in fs/ext4/super.c in the Linux kernel through 4.9.8 does not properly validate meta block…
-
Unscored —
include/linux/init_task.h in the Linux kernel before 2.6.35 does not prevent signals with a process group ID of zero fr…
-
Unscored —
The load_segment_descriptor implementation in arch/x86/kvm/emulate.c in the Linux kernel before 4.9.5 improperly emulat…
-
Unscored —
The nested_vmx_check_vmptr function in arch/x86/kvm/vmx.c in the Linux kernel through 4.9.8 improperly emulates the VMX…
-
Unscored —
The vc4_get_bcl function in drivers/gpu/drm/vc4/vc4_gem.c in the VideoCore DRM driver in the Linux kernel before 4.9.7 …
-
Unscored —
drivers/hid/hid-corsair.c in the Linux kernel 4.9.x before 4.9.6 interacts incorrectly with the CONFIG_VMAP_STACK optio…
-
Unscored —
drivers/net/ieee802154/atusb.c in the Linux kernel 4.9.x before 4.9.6 interacts incorrectly with the CONFIG_VMAP_STACK …
-
Unscored —
Off-by-one error in the pipe_advance function in lib/iov_iter.c in the Linux kernel before 4.9.5 allows local users to …
-
Unscored —
The freelist-randomization feature in mm/slab.c in the Linux kernel 4.8.x and 4.9.x before 4.9.5 allows local users to …
-
Unscored —
The simple_set_acl function in fs/posix_acl.c in the Linux kernel before 4.9.6 preserves the setgid bit during a setxat…
-
Unscored —
Integer overflow in the vc4_get_bcl function in drivers/gpu/drm/vc4/vc4_gem.c in the VideoCore DRM driver in the Linux …
-
Unscored —
The klsi_105_get_line_state function in drivers/usb/serial/kl5kusb105.c in the Linux kernel before 4.9.5 places uniniti…
-
Unscored —
An issue was discovered on SendQuick Entera and Avera devices before 2HF16. Multiple Command Injection vulnerabilities …
-
Unscored —
An issue was discovered on SendQuick Entera and Avera devices before 2HF16. The application failed to check the access …
-
Unscored —
An issue was discovered on SendQuick Entera and Avera devices before 2HF16. An attacker could request and download the …
-
Unscored —
Cross-site scripting (XSS) vulnerability in index.asp in SANADATA SanaCMS 7.3 allows remote attackers to inject arbitra…
-
Medium 6.1
Plone XSS in Zope ZMI
Cross-site scripting (XSS) vulnerability in the manage_findResult component in the search feature in Zope ZMI in Plone before 4.3.12 and 5.x before 5.0.7 allows remote attackers to inject arbitrary web script or HTML via vectors involving double quotes, as de…
-
Unscored —
Splunk Web in Splunk Enterprise versions 6.5.x before 6.5.2, 6.4.x before 6.4.5, 6.3.x before 6.3.9, 6.2.x before 6.2.1…
-
Unscored —
Unisys Libra 43xx, 63xx, and 83xx, and FS600 class systems with MCP-FIRMWARE 40.0 before 40.0IC4 Build 270 might allow …